Controls (WAF-COST)

Severity: High | Category: Cost Allocation | Automatable: High

Intent: Without tagging, no cost attribution is possible. Without cost attribution, no optimization is possible.

Requirement: All cloud resources MUST carry the mandatory tags: cost-center, owner, environment, workload. Missing tags MUST be treated as violations in the CI gate. No deployment without full tagging compliance.

Terraform Checks (excerpt):

Evidence:

Best Practice: Cost Allocation Tagging

Severity: High | Category: Budget Control | Automatable: High

Intent: Budget overruns discovered only in the monthly bill are too late.

Requirement: For every cloud account/subscription, a budget limit MUST be defined as an IaC resource. Alerts MUST be triggered automatically at 80% and 100% of the budget limit. Budget resources MUST be versioned and reviewable (not set in the console UI).

Terraform Checks (excerpt):

Evidence:

Severity: Medium | Category: Resource Optimization | Automatable: Medium

Intent: Over-provisioning is the most common form of cloud waste.

Requirement: All persistent compute resources MUST carry the tag rightsizing-reviewed with a date (< 90 days). Idle detection MUST be configured. Instances without a current rightsizing review are considered non-compliant.

Terraform Checks (excerpt):

Evidence:

Severity: High | Category: Retention Management | Automatable: High

Intent: Infinite retention is not a strategy. It is Architectural Cost Debt.

Requirement: All storage resources MUST have explicit lifecycle policies. All log groups MUST have a retention_in_days setting != 0 and != null. No S3 bucket, no Azure storage, no GCS bucket without defined lifecycle rules.

Terraform Checks (excerpt):

Evidence:

Severity: High | Category: Architectural Cost Debt | Automatable: Partial

Intent: Architectural cost debt arises in architecture decisions – that is where it must also be prevented.

Requirement: Every ADR with infrastructure impact MUST contain a structured cost impact section: TCO estimate, lock-in risk score (1–5), data transfer cost estimate, operational effort (FTE), exit cost estimate, 3-year NPV. ADRs with lock-in score >= 4 require architecture board approval.

Terraform Checks (excerpt):

Evidence:

Best Practice: Managing Architectural Cost Debt

Severity: Medium | Category: FinOps Governance | Automatable: Low–Medium

Intent: FinOps without structured review cycles is not a discipline – it is hope.

Requirement: Monthly engineering reviews MUST take place (action items, owner, due date documented). Quarterly architecture board reviews MUST take place (cost debt register sign-off). Review records MUST be available in writing and accessible.

Terraform Checks (excerpt):

Evidence:

Best Practice: Implementing FinOps Processes

Severity: Medium | Category: Observability Cost | Automatable: High

Intent: Observability costs are among the fastest-growing and hardest-to-control cloud cost drivers.

Requirement: Log groups MUST be categorized by retention tier (Hot: 7–30d, Warm: 30–90d, Cold: 90–365d, Archive: >365d). DEBUG level logging in production is prohibited without explicit justification. CloudWatch log groups MUST NOT have retention_in_days = 0. Trace sampling MUST be configured for high-volume services.

Terraform Checks (excerpt):

Evidence:

Best Practice: Retention Strategy

Severity: Medium | Category: Cost Optimization | Automatable: Medium

Intent: Running baseline workloads permanently on-demand means 30–60% higher costs without added value.

Requirement: Compute resources with >= 70% utilization over 30 days MUST be covered with reservations. All on-demand baseline instances MUST carry the tag capacity-commitment: reviewed with date. Spot/preemptible instances are preferred for variable workloads.

Terraform Checks (excerpt):

Evidence:

Severity: High | Category: Data Transfer | Automatable: Medium

Intent: Data transfer and egress costs are the most frequently underestimated cloud cost drivers.

Requirement: VPC Endpoints MUST be deployed for S3, KMS and internal services. Public IPs on internal compute resources are prohibited. CDN MUST be configured for publicly accessible media/assets. An egress budget alert MUST exist.

Terraform Checks (excerpt):

Evidence:

Best Practice: Greenfield FinOps by Design

Severity: Medium | Category: Architectural Cost Debt | Automatable: Partial

Intent: Undocumented cost debt is uncontrolled cost debt.

Requirement: A cost debt register MUST exist in the repository with: description, owner, estimated annual impact (€), creation date, target resolution date, status (monitoring/paydown/accepted), paydown plan or acceptance rationale. A quarterly architecture board review entry MUST be present.

Terraform Checks (excerpt):

Evidence:

Best Practice: Managing Architectural Cost Debt